TheHive-MitreProject

Project developed during an internship experience in the SOC division of Yarix Srl, a cybersecurity company.
In this company The Hive Project is used to manage all security events created by the monitoring systems installed in the clients networks. In the main page of this open source platform there are thousands of cases which cointain a single dangerous event that needs to be check by a security technician. Every case contains a specific page where it's possible to insert a TTP (Tactics, Techniques and Procedures) related to Mitre ATT&CK framework

Goals

There was two requests for this activity:

1. Create a WEB API used to request all the Mitre categories related to a specific alert (and update database with new alerts or new alert-TTP relations)
2. Create a WEB interface to modify alerts-TTP relations (it needed to be easy to use in order to simplify technician work)

Structure

There are two folders, one for the database management (classes, utility functions,..), the other for WEB functionalities (api and web interface).

Examples

Inside Images folder there are all the screenshot showing the web interface, an example of request-response and the waited results. More specifically, there are:

1. Main page
2. Display all Mitre enterprise framework and a single Mitre category
3. Page to create alert-TTP relations
4. Table displaying existing relations
5. Tools page
6. Error main page
7. WebAPI request-response example with Postman
8. The resulting TTP page of a test case (The Hive Project)
9. Relations table

Documentation

There isn't a real documentation for this project since it wasn't required from the supervisor. There are comments in every file to explain features and reasonings behind the code.
The only document written and uploaded here, it's the DB sctructure and its contraints.

Tools used for this project

1. MySQL & MySQL Workbench
2. Python & Flask (Jinjia)
3. HTML, CSS & Javascript
4. Pycharm & Git